Hi all,
If any one is willing to play with that camera, I advice to take a firmware backup first. There is a LVTTL header on the board that can be easily used with CH340 adapter.
(heat the screen borders with a hairdryer to remove it easily)
DISCLAIMER: I am not responsible for any bricked device following these instructions.Typical pinout for C200 - using almost same HW platform:
PIN1 - +3.3V (do not connect)
PIN2 - GND
PIN3 - TX (connect to RX on adapter)
PIN4 - RX (connect to TX on adapter)
Serial is 115200/8/1/n. Always identify ground and +3.3V with a multimeter first.
Boot sequence can be interrupted - from U-Boot, you can take a backup (done in chuncks of 256MB due to limited RAM - to save time you could do larger like 384MB as long as you do not override U-Boot relloc address/screen framebuffer but calculation is much easier with 256MB).
Considering 0x80000000 is the RAM start address (confirm that using bdinfo command), follow the steps:
PREREQ 1 - Insert a >=4GB SD Card
PREREQ 2 - mmc list--> you should see the SD Card and the Internal MMC
1 - mmc dev Y (where Y is the INTERNAL MMC)
2 - mmc read 0x80000000 0x0 0x80000
3 - mmc dev X (where X is the EXTERNAL SD)
4 - mmc write 0x80000000 0x0 0x80000
5 - mmc dev Y (where Y is the INTERNAL MMC)
6 - mmc read 0x80000000 0x80000 0x80000
7 - mmc dev X (where X is the EXTERNAL SD)
8 - mmc write 0x80000000 0x80000 0x80000
9 - mmc dev Y (where Y is the INTERNAL MMC)
10 - mmc read 0x80000000 0x100000 0x80000
11 - mmc dev X (where X is the EXTERNAL SD)
12 - mmc write 0x80000000 0x100000 0x80000
... (etc second parameter changes to 0x180000, 0x200000, 0x280000 ... until it complains there is nothing to read)
After it complains, for the last one you have to adjust the read size - if it says it could only read 0x60000 blocks, change the third value to 0x60000.
For a 4GB internal MMC, it will typically stop at 0x700000 + 0x6000.
I really advise to ALWAYS run the "mmcinfo" command before issuing any "mmc write" command to ensure the external SD is selected. If you do any mistake, you will erase the device flash and no recovery will be easily possible (even less if memory is BGA).
Then, you have a full copy of the MMC on your SD. To store that into a file using Linux, run "dd if=/dev/yourSDcard of=Camera.img bs=512 count=[last address + size, converted to DEC, for example 7733248 in the previous example]".
Note that there are a FAT and EXT3 partition on the device - if you use Windows (or OSX) to backup the SD, the automount will create a System Volume Information (or a .DS_Store file) on the card, so it wont be an exact copy, which is why I advise to use Linux (or use the read-only switch in your SD card adapter).
If you do not understand the previous commands, you will most likely brick your device - so please refrain yourself
![Smiley :)](https://www.eevblog.com/forum/Smileys/default/xsmiley.gif.pagespeed.ic.R8GFI-pF6f.png)
.
In addition, I think I found how to get root access to the device, however I would need a backup from someone to confirm that first.